Gammu SMS Daemon CVE-2026-76756

Exploitation requires that the attacker be authenticated with high-privilege (administrator-level) Drupal credentials, as indicated by PR:H in the CVSS vector. Additionally, AC:H indicates specific, non-default conditions must align - likely a particular configuration state of the Gammu SMS Daemon module, such as an active daemon connection or specific SMS routing configuration. The Gammu SMS Daemon module must be installed and enabled on the Drupal site. What limits exploitation: the high privilege requirement means a successful attacker must first compromise an admin account; the high complexity requirement means reliable triggering is not straightforward; and the module's niche deployment means the overall exposed population is small.

The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) reflects a meaningful tension: the impact metrics are severe (C:H/I:H), but the access bar is very high - an attacker must already hold high-privilege credentials and navigate elevated attack complexity. In practice, even a mid-sized municipal IT team in zabrze running an SMS-integrated Drupal deployment should assess this against their specific privilege model, since the vulnerability is chiefly dangerous in scenarios where an authenticated admin account is already compromised or an insider threat exists. No EPSS data was provided to quantify probability of exploitation, and the vulnerability is absent from the CISA KEV catalog, suggesting no confirmed active exploitation. The A:N metric is notable for a buffer overflow - this implies the flaw is more likely a controlled out-of-bounds read or write yielding data disclosure and potential integrity compromise rather than a crash, which somewhat constrains weaponization but does not eliminate it. No public exploit code has been identified, and the niche deployment footprint of an SMS-daemon Drupal module substantially limits the pool of at-risk systems.

An attacker who has obtained Drupal administrative credentials - through credential stuffing, phishing, or a separate vulnerability - navigates to the Gammu SMS Daemon configuration or message-handling interface and submits a crafted payload that exceeds buffer boundaries. Under the high-complexity conditions required, this triggers a CWE-119 memory corruption event that could allow reading or overwriting adjacent memory, potentially exposing sensitive data or achieving arbitrary writes within the daemon's memory space. No public exploit code has been identified at time of analysis.